@passioncode-ai/fabric-agent-adapter 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,52 @@
 # Changelog
 
+## 0.18.0 - 2026-10-12
+
+Services on Linux and Windows in both kits (contract DEC-0032, DEC-0033; FAA-21): the supervisor files the
+contract names, and the Node kit on Windows.
+
+### Added
+
+- **The supervisor writers, in both kits.** They write byte-identical files, and a test holds them to that.
+  - **Linux — a systemd user unit.** `systemd_unit` / `systemdUnit` writes `Restart=always`, `RestartSec=10`,
+    `TimeoutStopSec` above the drain, `WantedBy=default.target` and `FABRIC_SERVICE_SUPERVISOR=systemd`.
+    `systemd_install` / `systemdInstall` runs `daemon-reload` and `enable --now`. `systemd_uninstall` /
+    `systemdUninstall` runs `disable --now`, removes the unit, then runs `daemon-reload`.
+  - **Windows — a per-user Scheduled Task.** `task_xml` / `taskXml` writes a logon trigger, least privilege,
+    restart every minute on failure, no time limit and `IgnoreNew`. `task_install` / `taskInstall` runs
+    `schtasks /Create` from a UTF-16 file it then removes, then `/Run`. `task_uninstall` / `taskUninstall` runs
+    `/End`, then `/Delete`.
+  - **No secret in a supervisor file.** The writers refuse a credential-shaped argument, environment name or
+    value, and any control character.
+  - **An upgrade restarts what runs; the operator's off stays off (LC-14).** A unit that `is-enabled` reports
+    disabled, or a task whose settings say `Enabled false`, is rewritten and left off unless `force_enable`.
+  - **Checked by the real readers:** `systemd-analyze verify` on the Linux job (a quoted `WorkingDirectory=` is
+    refused there, so it is written unquoted), and `schtasks /Create` of a throwaway task on the Windows job.
+- **The Node kit on Windows and Linux:**
+  - `servicesDir` and `serviceDirs` use `%LOCALAPPDATA%`.
+  - `expand` and `validateDescriptor` match the Python kit: all four managers, `unit` and `task` paired with
+    their manager, Windows paths, never a network share.
+  - The token file gets a protected ACL: written with `icacls`, read with Windows PowerShell 5.1. A refusal
+    names the SID.
+  - The instance lock is a named pipe on Windows (an abstract socket on Linux, as before).
+- **One copy across the kits.** The Python kit holds the Node kit's lock name (`lock_name` / `lockName`)
+  beside its file lock, so the two kits exclude each other on every system. `check_service.py` now reports the
+  lock as held when a Node service holds it. Before this release it failed every Node service on Linux.
+- **A copy under systemd backs off on a held lock** as one under launchd does (`supervised()`).
+- **The Windows CI job** runs the Node kit's platform, supervisor and service tests and the Python supervisor
+  tests.
+- **Docs:**
+  - `references/lifecycle.md`, *Linux and Windows*: the verbs per system and the Windows directories.
+  - `SKILL.md` step 4.
+  - `protocol.md`.
+
+  The scenario eval `linux-and-windows-supervision` and two triggers came first.
+- **The probe only looks** (`/proc/net/unix`, `WaitNamedPipeW`) and never takes the lock's name.
+- **An independent review** found 2 critical and 9 moderate defects before release; each is fixed with a test, except
+  that a Scheduled Task still cannot tell the service it is supervised (a task sets no environment; documented).
+- **Mutation testing:** 14 planted defects in the Python writers, 23 in the Node port, 7 in the lock name
+  and probe and a quoted `WorkingDirectory=` against `systemd-analyze` were all caught.
+
 ## 0.17.0 - 2026-10-12
 
 The organisation's lifecycle rules LC-19 and LC-21 apply to what the adapter ships and checks (FAA-22, FAA-23):

package/README.md

@@ -230,8 +230,8 @@ FABRIC_CONTRACT_OLD=/path/to/legacy-contract FABRIC_CONTRACT_NEW=/path/to/curren
 ```
 
 Without both environment variables, those tests explicitly skip as `NOT_RUN`.
-This source checkout is 0.17.0. 0.16.0 is the latest published GitHub/npm release (2026-10-12; 0.7.0 and 0.11.0
-were never released); 0.17.0 is published by its `v0.17.0` tag. Source delivery does not update installed skills or live sessions.
+This source checkout is 0.18.0. 0.17.0 is the latest published GitHub/npm release (2026-10-12; 0.7.0 and 0.11.0
+were never released); 0.18.0 is published by its `v0.18.0` tag. Source delivery does not update installed skills or live sessions.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.17.0"
+  version: "0.18.0"
   contract-version: "0.1.0"
   contract-commit: "0cacd08b0e95b6abf131eae1206b60792138bc3c"
 ---

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -13,10 +13,10 @@ description: >-
   kits, a TLS sample, live and layout probes. NOT for a one-off script or cron job, a hosted product with no agent
   behind it, the provider manifest (adapting-projects-to-fabric), or building Fabric Dashboards.
 license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
-compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only (Linux services use lifecycle manager none until a systemd adapter exists). Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
+compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.17.0"
+  version: "0.18.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "0cacd08b0e95b6abf131eae1206b60792138bc3c"
@@ -190,10 +190,14 @@ The installer, not the service, owns the plist and the descriptor. Sequence:
 4. After an upgrade, `prune_releases(releases_dir, current=…)` keeps the running release
    and the one before it.
 
+On Linux the supervisor is a systemd user unit (`systemd_unit` + `systemd_install`), on
+Windows a per-user Scheduled Task (`task_xml` + `task_install`); the Node kit has the same
+writers (`systemdUnit`, `taskXml`, …) and both kits write identical files.
+
 Code runs from an immutable release directory; an upgrade writes a new release,
 rewrites the plist and restarts. Read [the lifecycle reference](references/lifecycle.md)
 for the plist fields, the release layout, log rotation, behaving under a host lifecycle broker
-and the Linux case.
+and the Linux and Windows supervisors.
 
 ## Step 5 — the dashboard and the events
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md

@@ -8,23 +8,23 @@ wins and this page is the defect. The rule each section serves:
 | Contract rule | Here | Kit (Python / Node) |
 |---|---|---|
 | LC-01 quit reaches exit within a deadline | [Shutdown](#shutdown) | `Drain` / `Drain` |
-| LC-03 a job is bounded and exclusive | [one copy under launchd](#one-copy-under-launchd) | `hold_single_instance` / `holdSingleInstance` |
-| LC-09 the footprint is declared | the descriptor and the plist; the service's own `AGENTS.md` names its label and port | `write_descriptor`, `launchd_plist` |
+| LC-03 a job is bounded and exclusive | [one copy under a supervisor](#one-copy-under-a-supervisor) | `hold_single_instance` / `holdSingleInstance` |
+| LC-09 the footprint is declared | the descriptor and the plist, unit or task; the service's own `AGENTS.md` names its label (unit, task) and port | `write_descriptor`, `launchd_plist`, `systemd_unit` / `systemdUnit`, `task_xml` / `taskXml` |
 | LC-11 previous release kept, older pruned | [Install, upgrade, uninstall](#install-upgrade-uninstall) | `prune_releases` / `pruneReleases` |
 | LC-12 every file is bounded | [Logs](#logs) | `RotatingLog`, `cap_stdout_log` / `RotatingLog`, `capStdoutLog` |
-| LC-14 operator intent wins; uninstall is symmetric | [Install, upgrade, uninstall](#install-upgrade-uninstall) | `launchd_install`, `launchd_uninstall` (Python) |
+| LC-14 operator intent wins; uninstall is symmetric | [Install, upgrade, uninstall](#install-upgrade-uninstall), [Linux and Windows](#linux-and-windows) | `launchd_install`, `launchd_uninstall` (Python); `systemd_install` / `systemdInstall`, `task_install` / `taskInstall` and their uninstalls |
 | LC-15 builds clean up after themselves | release pruning runs inside the installer, not later | `prune_releases` / `pruneReleases` |
 
 ## Contents
 
 - [launchd plist](#launchd-plist-generate-it-with-launchd_plist)
 - [Install, upgrade, uninstall](#install-upgrade-uninstall)
-- [One copy under launchd](#one-copy-under-launchd)
+- [One copy under a supervisor](#one-copy-under-a-supervisor)
 - [Directories](#directories)
 - [Logs](#logs)
 - [Shutdown](#shutdown)
 - [Being managed by a host lifecycle broker](#being-managed-by-a-host-lifecycle-broker)
-- [Linux](#linux)
+- [Linux and Windows](#linux-and-windows)
 
 ## launchd plist (generate it with `launchd_plist`)
 
@@ -70,24 +70,24 @@ that deletes an override, and a leftover `disabled` would make a later fresh ins
 off. Tests use a throwaway label or a fake `launchctl` first on `PATH` — never the
 operator's real jobs.
 
-## One copy under launchd
+## One copy under a supervisor
 
 Started by hand, a copy that finds `service.lock` held prints one sentence naming the
 holder and exits 75 at once. Under launchd that exit is a respawn every `ThrottleInterval`
-(10 s), forever. So a copy whose plist carries `FABRIC_SERVICE_SUPERVISOR=launchd` backs
-off in-process — 0.5 s doubling to 30 s, 300 s in all — takes over if the holder leaves,
+(10 s), forever, and under systemd one every `RestartSec`. So a copy whose plist or unit
+carries `FABRIC_SERVICE_SUPERVISOR=launchd` (or `systemd`) backs off in-process — 0.5 s doubling to 30 s, 300 s in all — takes over if the holder leaves,
 and exits 75 only when the wait runs out: a few starts an hour instead of 360. It touches
 nothing while it waits. Two installs sharing one data directory are still the defect to
 remove; the back-off only stops the loop from costing the machine.
 
 ## Directories
 
-| What | macOS | Linux |
-|---|---|---|
-| data + config | `~/Library/Application Support/<id>/` | `${XDG_DATA_HOME:-~/.local/share}/<id>/` |
-| logs | `~/Library/Logs/<id>/` | `${XDG_STATE_HOME:-~/.local/state}/<id>/logs/` |
-| cache (deletable any time) | `~/Library/Caches/<id>/` | `${XDG_CACHE_HOME:-~/.cache}/<id>/` |
-| code | `~/.local/share/<id>/releases/…` | same |
+| What | macOS | Linux | Windows (DEC-0032) |
+|---|---|---|---|
+| data + config | `~/Library/Application Support/<id>/` | `${XDG_DATA_HOME:-~/.local/share}/<id>/` | `%LOCALAPPDATA%\<id>\` |
+| logs | `~/Library/Logs/<id>/` | `${XDG_STATE_HOME:-~/.local/state}/<id>/logs/` | `%LOCALAPPDATA%\<id>\Logs\` |
+| cache (deletable any time) | `~/Library/Caches/<id>/` | `${XDG_CACHE_HOME:-~/.cache}/<id>/` | `%LOCALAPPDATA%\<id>\Cache\` |
+| code | `~/.local/share/<id>/releases/…` | same | under `%LOCALAPPDATA%` too, never a network share |
 
 A repository that versions the data itself (a registry, a plan) may hold the data; the
 service's own code checkout and its releases may not. Directories 0700, secret files 0600. A store carries a schema version and the service
@@ -140,8 +140,58 @@ has to survive being driven from outside:
   well-known document for a service, a process-level answer for a plain app — and keep it honest
   while the app is still starting.
 
-## Linux
-
-Until a systemd adapter exists, declare `lifecycle.manager: "none"`. A `systemd --user`
-unit with `Restart=always` gives the same guarantees; the host will control it once the
-adapter ships. Everything else in this skill applies unchanged.
+## Linux and Windows
+
+Both kits write and install the supervisor file the contract names (DEC-0032, service.md
+*Supervisor*); the two kits write byte-identical files. A supervisor file never carries a
+secret: the writers refuse a credential-shaped argument, environment name or value, and any
+control character (a line break would end a unit line early).
+
+**Linux — a systemd user unit.** `systemd_unit(unit, argv, working_directory=…)` /
+`systemdUnit(unit, argv, {workingDirectory})` writes `Restart=always`, `RestartSec=10`,
+`TimeoutStopSec` above the drain (15 s default), `KillMode=mixed`, `WantedBy=default.target`
+and `FABRIC_SERVICE_SUPERVISOR=systemd`, quoting every argument (`%` → `%%`, `$` → `$$`).
+`WorkingDirectory=` is written unquoted: systemd reads it as the rest of the line, so quotes would
+become part of the path and the unit would be refused (`systemd-analyze verify` checks it in CI). The
+descriptor says `"lifecycle": {"manager": "systemd", "unit": "<id>.<instance>.service"}`.
+
+| Verb | Command |
+|---|---|
+| install, upgrade | `systemd_install` / `systemdInstall`: write `~/.config/systemd/user/<unit>`, `daemon-reload`, `enable`, `restart` (so the new unit is what runs). A unit already installed that `is-enabled` reports `disabled` stays off: the file is rewritten and nothing starts (LC-14), unless `force_enable` |
+| stop, keep off | `systemctl --user disable --now <unit>` |
+| uninstall | `systemd_uninstall` / `systemdUninstall`: `disable --now`, remove the unit, `daemon-reload` |
+
+A user unit runs while the person is logged in; one that must run without a session needs
+`loginctl enable-linger <user>`, which is the operator's decision, not the installer's.
+
+**Windows — a per-user Scheduled Task.** `task_xml(task, argv, working_directory=…)` /
+`taskXml(task, argv, {workingDirectory})` writes a task with a logon trigger for the current
+user, `InteractiveToken` and `LeastPrivilege` (no administrator rights), restart on failure
+every minute, no execution time limit and `MultipleInstancesPolicy` `IgnoreNew`, its settings in the
+order `schtasks` exports them; the arguments are quoted the way the C runtime parses them. The Windows
+CI job has the real `schtasks` create, read back and delete such a task. The descriptor says
+`"lifecycle": {"manager": "task-scheduler", "task": "\\PassionCode\\<id>.<instance>"}`.
+
+| Verb | Command |
+|---|---|
+| install, upgrade | `task_install` / `taskInstall`: `schtasks /Create /TN <task> /XML <file> /F` from a UTF-16 file it then removes, then `/End` (when it existed) and `/Run`. A task already installed and disabled stays off: it is recreated and disabled again (LC-14), unless `force_enable` |
+| stop, keep off | `schtasks /End /TN <task>`, then `schtasks /Change /TN <task> /DISABLE` |
+| uninstall | `task_uninstall` / `taskUninstall`: `/End`, then `/Delete /F` |
+
+A task cannot set an environment variable, so a copy Task Scheduler restarts does not back off
+in-process; `IgnoreNew` keeps the scheduler from starting a second copy, and a hand-started copy
+holding the lock makes the scheduled one exit 75 once a minute until it leaves.
+
+**One copy on each system.** The Python kit takes `flock` (Linux) or a locked byte
+(Windows); the Node kit cannot, so it holds a name instead — an abstract unix socket on Linux,
+a named pipe on Windows (`lock_name` / `lockName`), each gone with the process. The Python kit
+holds the same name beside its file lock, so the two kits exclude each other everywhere, and
+`check_service.py` reports the lock held when either is. The probe only looks (`/proc/net/unix`,
+`WaitNamedPipeW`); it never takes the name, so it cannot make a service that is starting fail.
+
+**Token files on Windows.** The privacy of `service.token` is its ACL (service.md *Windows
+token files*): the kits write a protected list — the user, SYSTEM and Administrators, set before the
+token's bytes go in, any entry already there dropped — and refuse
+on read a link, a file outside the profile, another owner, or any other granted SID, naming the
+SID. The Node kit reads the list with Windows PowerShell 5.1 (.NET, no modules) and writes it
+with `icacls`; the path goes through the environment, never a command line.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -31,7 +31,7 @@ File `<id>.<instance>.json`, mode 0600 (on Windows a protected ACL), atomic.
 | `name`, `summary` | ≤ 80 and ≤ 200 characters |
 | `origin` | `http://127.0.0.1:<port>`; the port is a machine-wide claim |
 | `auth` | `tokenFile` (0600; on Windows a protected ACL — owner and every granting entry the current user, SYSTEM or Administrators: service.md *Windows token files*, DEC-0032, DEC-0033); `header` default `Authorization` with `scheme` `Bearer`; any other header carries the raw token with `scheme: "none"` |
-| `lifecycle` | `manager` `launchd` (then `label` and `plist`), `systemd` (then `unit`, a `systemctl --user` unit), `task-scheduler` (then `task`, a per-user Scheduled Task) or `none`; `unit` and `task` are refused beside any other manager (DEC-0032). The Python kit and the probe accept all four; the Node kit still accepts only `launchd` and `none` (FAA-16) |
+| `lifecycle` | `manager` `launchd` (then `label` and `plist`), `systemd` (then `unit`, a `systemctl --user` unit), `task-scheduler` (then `task`, a per-user Scheduled Task) or `none`; `unit` and `task` are refused beside any other manager (DEC-0032). Both kits and the probe accept all four; both kits write the unit and the task (`systemd_unit`, `task_xml` / `systemdUnit`, `taskXml`) |
 | `paths` | `data` (required), `logs[]`, optional `config`, `cache` |
 | `commands` | only `doctor` and `update`, argument arrays whose first item is an absolute or `~/` path (Windows: also `C:\…`, `C:/…` or `~\…`, never a network share — DEC-0032) |
 | `source.repository`, `fabricManifest` | optional |

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -730,7 +730,7 @@ class Probe:
                     self.add("lifecycle.instance-lock", "PASS", "held by the running service")
                 else:
                     msvcrt.locking(fd, msvcrt.LK_UNLCK, 1)
-                    self.add("lifecycle.instance-lock", "FAIL", "%s exists but nobody holds it" % lock)
+                    self.lock_free(lock)
             finally:
                 os.close(fd)
             return
@@ -747,10 +747,17 @@ class Probe:
             self.add("lifecycle.instance-lock", "PASS" if held else "FAIL", "held by the running service" if held else str(exc))
         else:
             fcntl.flock(fd, fcntl.LOCK_UN)
-            self.add("lifecycle.instance-lock", "FAIL", "%s exists but nobody holds it" % lock)
+            self.lock_free(lock)
         finally:
             os.close(fd)
 
+    def lock_free(self, lock: Path) -> None:
+        """The file lock is free; a Node kit service holds the lock's name instead (fs.lock_name)."""
+        if fs.lock_name_held(lock):
+            self.add("lifecycle.instance-lock", "PASS", "held by the running service (the lock's name, %s)" % ("a named pipe" if fs.WINDOWS else "an abstract socket"))
+        else:
+            self.add("lifecycle.instance-lock", "FAIL", "%s exists but nobody holds it" % lock)
+
     def run(self) -> List[Result]:
         self.descriptor_rules()
         if not self.port:

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-service.mjs

@@ -3,11 +3,13 @@
 // Normative source: fabric-agent-contract docs/specification/service.md (DEC-0015; the remote
 // placement — an online agent or dashboard at an https origin — DEC-0019; the usage report DEC-0021).
 
+import { spawnSync } from 'node:child_process';
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
+import { credentialName, secretArgument, secretValue } from './fabric-secrets.mjs';
 
 export const PROTOCOL = 'fabric-service/0.1';
 export const EXTENSION_KEY = 'https://fabric.passioncode.ai/agent-contract/extensions/service/0.1';
@@ -49,6 +51,13 @@ const CODE = /^[A-Za-z0-9_-]{16,256}$/;
 const TRACE_ID = /^(?!0{32}$)[0-9a-f]{32}$/;
 const SPAN_ID = /^(?!0{16}$)[0-9a-f]{16}$/;
 const O_EXLOCK = 0x20; // BSD/macOS: open(2) takes flock(LOCK_EX); absent from fs.constants
+// DEC-0032: a local path starts with ~/ (or ~\ on Windows), / (never //) or a drive letter; a network share never does.
+const LOCAL_PATH = /^(~[\\/]|\/(?!\/)|[A-Za-z]:[\\/])/;
+export const MANAGERS = Object.freeze(['launchd', 'systemd', 'task-scheduler', 'none']);
+const UNIT = /^[A-Za-z0-9][A-Za-z0-9:_.@-]{0,250}\.service$/;
+const TASK = /^\\[A-Za-z0-9 ._\\-]{1,254}$/;
+export const WINDOWS_TRUSTED = Object.freeze(['S-1-5-18', 'S-1-5-32-544']);
+export const DEFAULT_EXIT_TIMEOUT = 15;
 
 export class ServiceError extends Error {}
 export class AlreadyRunning extends ServiceError {
@@ -61,29 +70,42 @@ export class AlreadyRunning extends ServiceError {
 
 export const nowIso = () => new Date().toISOString().replace(/\.\d{3}Z$/, 'Z');
 
-export function expand(p) {
-  const out = p.startsWith('~/') ? path.join(os.homedir(), p.slice(2)) : p;
-  if (!path.isAbsolute(out)) throw new ServiceError(`Path ${p} must be absolute or start with ~/.`);
+/** Paths in a descriptor may start with ~/ (or ~\\ on Windows); everything else must be absolute,
+ * and a network share is never a local path (DEC-0032). */
+export function expand(p, platform = process.platform) {
+  if (!LOCAL_PATH.test(String(p))) throw new ServiceError(`Path ${p} must be absolute or start with ~/.`);
+  const out = /^~[\\/]/.test(p) ? path.join(os.homedir(), p.slice(2)) : p;
+  // On Windows an absolute path names its drive: `/x` is relative to the current drive (the Python kit refuses it too).
+  const absolute = platform === 'win32' ? /^[A-Za-z]:[\\/]/.test(out) : path.posix.isAbsolute(out);
+  if (!absolute) throw new ServiceError(`Path ${p} must be absolute or start with ~/.`);
   return out;
 }
 
-export function servicesDir() {
+// DEC-0032: LOCALAPPDATA, not APPDATA, so token files never roam with the profile.
+const localAppData = () => process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+
+export function servicesDir(platform = process.platform) {
   if (process.env.FABRIC_SERVICES_DIR) return expand(process.env.FABRIC_SERVICES_DIR);
   const home = os.homedir();
-  if (process.platform === 'darwin') return path.join(home, 'Library/Application Support/ai.passioncode.fabric/services');
+  if (platform === 'darwin') return path.join(home, 'Library/Application Support/ai.passioncode.fabric/services');
+  if (platform === 'win32') return path.join(localAppData(), 'passioncode-fabric', 'services');
   return path.join(process.env.XDG_DATA_HOME || path.join(home, '.local/share'), 'passioncode-fabric/services');
 }
 
-export function serviceDirs(id) {
+export function serviceDirs(id, platform = process.platform) {
   if (!ID.test(id)) throw new ServiceError(`Service id ${id} must match ${ID}.`);
   const home = os.homedir();
-  if (process.platform === 'darwin') {
+  if (platform === 'darwin') {
     return {
       data: path.join(home, 'Library/Application Support', id),
       logs: path.join(home, 'Library/Logs', id),
       cache: path.join(home, 'Library/Caches', id),
     };
   }
+  if (platform === 'win32') {
+    const data = path.join(localAppData(), id);
+    return { data, logs: path.join(data, 'Logs'), cache: path.join(data, 'Cache') };
+  }
   return {
     data: path.join(process.env.XDG_DATA_HOME || path.join(home, '.local/share'), id),
     logs: path.join(process.env.XDG_STATE_HOME || path.join(home, '.local/state'), id, 'logs'),
@@ -93,7 +115,8 @@ export function serviceDirs(id) {
 
 export function ensurePrivateDir(dir) {
   fs.mkdirSync(dir, { recursive: true });
-  fs.chmodSync(dir, 0o700);
+  if (process.platform === 'win32') windowsProtect(dir, { folder: true });
+  else fs.chmodSync(dir, 0o700);
   return dir;
 }
 
@@ -102,13 +125,16 @@ export function atomicWrite(file, data, mode = 0o600) {
   const tmp = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${crypto.randomBytes(4).toString('hex')}`);
   const fd = fs.openSync(tmp, 'wx', mode);
   try {
+    // On Windows the file's ACL is its privacy (DEC-0032): set explicitly and protected — before the bytes go in —
+    // so it does not depend on what the folder hands down. A rename keeps it.
+    if (process.platform === 'win32') windowsProtect(tmp, { folder: false });
     fs.writeSync(fd, data);
     fs.fsyncSync(fd);
   } finally {
     fs.closeSync(fd);
   }
   try {
-    fs.chmodSync(tmp, mode);
+    if (process.platform !== 'win32') fs.chmodSync(tmp, mode);
     fs.renameSync(tmp, file);
   } catch (error) {
     fs.rmSync(tmp, { force: true });
@@ -140,11 +166,15 @@ export class InstanceLock {
       fs.fsyncSync(this.fd);
       return this;
     }
-    // Linux: an abstract unix socket is exclusive, has no file, and dies with the process.
-    const name = `\0fabric-service-${crypto.createHash('sha256').update(path.resolve(this.path)).digest('hex').slice(0, 32)}`;
+    // Linux: an abstract unix socket; Windows: a named pipe. Each is exclusive, has no file, and dies
+    // with the process. The Python kit holds the same name beside its file lock (fabric_service.lock_name).
+    const name = lockName(this.path);
+    if (!name) throw new ServiceError(`No instance lock on ${process.platform}: the kit supports macOS, Linux and Windows.`);
     this.server = net.createServer();
     await new Promise((resolve, reject) => {
-      this.server.once('error', (error) => reject(error.code === 'EADDRINUSE' ? new AlreadyRunning(readPid(this.path), this.path) : error));
+      // Windows reports a held pipe as EADDRINUSE (access denied) or, when its holder capped the instances, EBUSY.
+      const held = (code) => code === 'EADDRINUSE' || (process.platform === 'win32' && code === 'EBUSY');
+      this.server.once('error', (error) => reject(held(error.code) ? new AlreadyRunning(readPid(this.path), this.path) : error));
       this.server.listen(name, resolve);
     });
     this.server.unref();
@@ -160,6 +190,15 @@ export class InstanceLock {
   }
 }
 
+/** The name the lock is held under on Linux (abstract socket) and Windows (named pipe); null on macOS. */
+export function lockName(lockPath, platform = process.platform) {
+  const digest = (text) => crypto.createHash('sha256').update(text).digest('hex').slice(0, 32);
+  if (platform === 'linux') return `\0fabric-service-${digest(path.posix.resolve(lockPath))}`;
+  // Windows paths compare without case: C:\Users and c:\users are one lock.
+  if (platform === 'win32') return `\\\\.\\pipe\\fabric-service-${digest(path.win32.resolve(lockPath).toLowerCase())}`;
+  return null;
+}
+
 function readPid(file) {
   try {
     const text = fs.readFileSync(file, 'utf8').trim();
@@ -171,6 +210,9 @@ function readPid(file) {
 
 /** True when launchd started this process from a plist that says so (FABRIC_SERVICE_SUPERVISOR=launchd). */
 export const supervisedByLaunchd = () => process.env[SUPERVISOR_ENV] === 'launchd';
+export const SUPERVISORS = Object.freeze(['launchd', 'systemd', 'task-scheduler']);
+/** True when a supervisor that restarts on exit started this process and said so (launchd, systemd). */
+export const supervised = () => SUPERVISORS.includes(process.env[SUPERVISOR_ENV]);
 
 const sleepSeconds = (s) => new Promise((resolve) => setTimeout(resolve, s * 1000));
 
@@ -184,7 +226,7 @@ const sleepSeconds = (s) => new Promise((resolve) => setTimeout(resolve, s * 100
 export async function holdSingleInstance(dataDir, {
   waitSeconds, sleep = sleepSeconds, clock = () => performance.now() / 1000, exit = (code) => process.exit(code),
 } = {}) {
-  const wait = waitSeconds ?? (supervisedByLaunchd() ? LOCK_WAIT_SUPERVISED_SECONDS : 0);
+  const wait = waitSeconds ?? (supervised() ? LOCK_WAIT_SUPERVISED_SECONDS : 0);
   const deadline = clock() + Math.max(0, wait);
   let delay = LOCK_BACKOFF_FIRST_SECONDS;
   let announced = false;
@@ -218,16 +260,110 @@ export function ensureToken(file) {
   return token;
 }
 
+/**
+ * Refuse a symlink, a file owned by someone else, or one others can read. On Windows the rule is
+ * service.md "Windows token files" (DEC-0032, DEC-0033): a regular file whose real path is in the
+ * profile, owned by the current user, SYSTEM or Administrators, every granting ACE naming one of
+ * those three; a refusal names the SID, never the contents.
+ */
 export function readToken(file) {
   const info = fs.lstatSync(file);
   if (info.isSymbolicLink()) throw new ServiceError(`Token file ${file} is a symlink; refusing it.`);
-  if (typeof process.getuid === 'function' && info.uid !== process.getuid()) throw new ServiceError(`Token file ${file} belongs to another user.`);
-  if (info.mode & 0o077) throw new ServiceError(`Token file ${file} is readable by others; set mode 0600.`);
+  if (process.platform === 'win32') {
+    const problem = windowsTokenProblem(file, info);
+    if (problem) throw new ServiceError(problem);
+  } else {
+    if (typeof process.getuid === 'function' && info.uid !== process.getuid()) throw new ServiceError(`Token file ${file} belongs to another user.`);
+    if (info.mode & 0o077) throw new ServiceError(`Token file ${file} is readable by others; set mode 0600.`);
+  }
   const token = fs.readFileSync(file, 'utf8').trim();
   if (token.length < 16) throw new ServiceError(`Token file ${file} holds no usable token.`);
   return token;
 }
 
+// --- Windows ACLs (DEC-0032) ------------------------------------------------------
+// Node has no ACL API. Windows PowerShell (5.1, present on every Windows) reads the list through .NET
+// and icacls writes it; both get the path through the environment, never argv, and print no contents.
+
+/**
+ * service.md "Windows token files", rules 2 and 3, on SIDs already read: the owner is the current
+ * user, SYSTEM or Administrators (DEC-0033), and every SID an allow ACE grants anything to is one of
+ * those three. Deny ACEs are not passed in: they do not change the decision.
+ */
+export function tokenAclProblem(file, owner, granting, user) {
+  if (owner !== user && !WINDOWS_TRUSTED.includes(owner)) {
+    return `Token file ${file} is owned by ${owner || 'nobody'}, not by this user (${user}), SYSTEM or Administrators.`;
+  }
+  for (const sid of granting) {
+    if (sid !== user && !WINDOWS_TRUSTED.includes(sid)) return `Token file ${file} grants access to ${sid}; only this user, SYSTEM and Administrators may hold any.`;
+  }
+  return null;
+}
+
+const ACL_SCRIPT = [
+  "$ErrorActionPreference = 'Stop'",
+  '$sid = [System.Security.Principal.SecurityIdentifier]',
+  '$acl = [System.IO.File]::GetAccessControl($env:FABRIC_ACL_PATH)',
+  "$null_dacl = $acl.GetSecurityDescriptorSddlForm('Access') -match 'NO_ACCESS_CONTROL' -or $acl.GetSecurityDescriptorSddlForm('Access') -eq ''",
+  // InheritOnly (2) applies to children, not to the file itself.
+  "$granting = @($acl.GetAccessRules($true, $true, $sid) | Where-Object { $_.AccessControlType -eq 'Allow' -and -not ([int]$_.PropagationFlags -band 2) } | ForEach-Object { $_.IdentityReference.Value })",
+  '$user = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value',
+  '[Console]::Out.Write((ConvertTo-Json -Compress @{ owner = $acl.GetOwner($sid).Value; granting = $granting; nullDacl = [bool]$null_dacl; user = $user }))',
+].join('; ');
+
+function windowsHelper(command, args, extraEnv = {}) {
+  // No PSModulePath: the script uses .NET only, and a module path inherited from PowerShell 7 makes
+  // Windows PowerShell load the wrong modules.
+  const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => k.toLowerCase() !== 'psmodulepath'));
+  const result = spawnSync(command, args, { env: { ...env, ...extraEnv }, encoding: 'utf8', windowsHide: true, timeout: 30_000 });
+  if (result.error || result.status !== 0) {
+    throw new ServiceError(`${command} failed: ${(result.error?.message || result.stderr || result.stdout || '').trim().slice(0, 200)}`);
+  }
+  return result.stdout;
+}
+
+/** The ACL report PowerShell prints, reduced to (owner, granting SIDs, current user). */
+export function parseAclReport(text) {
+  const report = JSON.parse(text);
+  const granting = report.nullDacl ? ['S-1-1-0'] : [].concat(report.granting ?? []);
+  return { owner: report.owner ?? '', granting, user: report.user };
+}
+
+/** (owner SID, SIDs of every allow ACE on the file itself, the current user's SID). */
+export function windowsAcl(file) {
+  return parseAclReport(windowsHelper('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', ACL_SCRIPT], { FABRIC_ACL_PATH: file }));
+}
+
+let userSid = null;
+export function windowsUserSid() {
+  if (!userSid) {
+    const line = windowsHelper('whoami.exe', ['/user', '/fo', 'csv', '/nh']).trim();
+    userSid = (line.match(/"(S-1-[0-9-]+)"\s*$/) ?? [])[1];
+    if (!userSid) throw new ServiceError('whoami /user printed no SID.');
+  }
+  return userSid;
+}
+
+/**
+ * A protected list (inheritance off): this user, SYSTEM, Administrators, full control; a folder hands it down.
+ * `/reset` first drops any explicit entry already there (`/inheritance:r` keeps those), so the three are all that remain.
+ */
+export function windowsProtect(target, { folder }) {
+  const grant = folder ? '(OI)(CI)F' : 'F';
+  windowsHelper('icacls.exe', [target, '/reset']);
+  windowsHelper('icacls.exe', [target, '/inheritance:r', '/grant:r', ...[windowsUserSid(), ...WINDOWS_TRUSTED].map((sid) => `*${sid}:${grant}`)]);
+}
+
+function windowsTokenProblem(file, info) {
+  if (!info.isFile()) return `Token file ${file} is not a regular file (a link or junction); refusing it.`;
+  const profile = fs.realpathSync.native(process.env.USERPROFILE || os.homedir()).toLowerCase();
+  const real = fs.realpathSync.native(file).toLowerCase();
+  const inside = path.win32.relative(profile, real);
+  if (!inside || inside.startsWith('..') || path.win32.isAbsolute(inside)) return `Token file ${file} lies outside the user's profile; refusing it.`;
+  const { owner, granting, user } = windowsAcl(file);
+  return tokenAclProblem(file, owner, granting, user);
+}
+
 export function tokenMatches(presented, token, scheme = 'Bearer') {
   if (!presented) return false;
   let value = presented;
@@ -278,22 +414,37 @@ export function validateDescriptor(d) {
   if (remote) problems.push(...remoteOriginProblems(d.origin));
   else if (!ORIGIN.test(d.origin)) problems.push('origin must be http://127.0.0.1:<port>');
   if (!d.auth?.tokenFile) problems.push('auth.tokenFile is required');
+  else if (!LOCAL_PATH.test(String(d.auth.tokenFile))) problems.push('auth.tokenFile must be a local path, never a network share');
+  for (const value of [...(d.paths?.data !== undefined ? [d.paths.data] : []), ...(d.paths?.logs ?? [])]) {
+    if (!LOCAL_PATH.test(String(value))) problems.push(`paths must be local paths, never a network share: ${JSON.stringify(value)}`);
+  }
   if ((d.auth?.header ?? 'Authorization') !== 'Authorization' && (d.auth?.scheme ?? 'Bearer') !== 'none') {
     problems.push('a custom auth header carries the raw token: scheme must be none');
   }
-  if (!['launchd', 'none'].includes(d.lifecycle?.manager)) problems.push('lifecycle.manager must be launchd or none');
-  if (d.lifecycle?.manager === 'launchd' && !(d.lifecycle.label && String(d.lifecycle.plist ?? '').endsWith('.plist'))) {
+  const life = d.lifecycle ?? {};
+  const manager = life.manager;
+  if (!MANAGERS.includes(manager)) problems.push('lifecycle.manager must be launchd, systemd, task-scheduler or none');
+  if (manager === 'launchd' && !(life.label && String(life.plist ?? '').endsWith('.plist'))) {
     problems.push('a launchd service declares label and plist');
   }
+  if (life.plist !== undefined && !LOCAL_PATH.test(String(life.plist))) problems.push('lifecycle.plist must be a local path');
+  // DEC-0032: `unit` goes with systemd and `task` with Task Scheduler, and with nothing else.
+  for (const [field, owner, pattern] of [['unit', 'systemd', UNIT], ['task', 'task-scheduler', TASK]]) {
+    if (manager === owner && life[field] === undefined) problems.push(`a ${owner} service declares ${field}`);
+    if (life[field] !== undefined && manager !== owner) problems.push(`lifecycle.${field} belongs to manager ${owner} only`);
+    if (life[field] !== undefined && !pattern.test(String(life[field]))) problems.push(`lifecycle.${field} must match ${pattern.source}`);
+  }
   if (remote) {
-    if (d.lifecycle?.manager !== 'none') problems.push('a remote service is supervised by its platform: lifecycle.manager must be none');
-    for (const field of ['label', 'plist']) if (d.lifecycle?.[field] !== undefined) problems.push(`a remote service has no launchd ${field}`);
+    if (manager !== 'none') problems.push('a remote service is supervised by its platform: lifecycle.manager must be none');
+    for (const [field, of] of [['label', 'launchd'], ['plist', 'launchd'], ['unit', 'systemd'], ['task', 'Task Scheduler']]) {
+      if (life[field] !== undefined) problems.push(`a remote service has no ${of} ${field}`);
+    }
     if (d.commands?.update !== undefined) problems.push('a remote service declares no update command');
   }
   for (const [name, argv] of Object.entries(d.commands ?? {})) {
     if (!['doctor', 'update'].includes(name)) problems.push(`unknown command ${name}`);
     else if (!Array.isArray(argv) || !argv.length || !argv.every((a) => typeof a === 'string')) problems.push(`command ${name} must be an argument array`);
-    else if (!/^(~\/|\/)/.test(argv[0])) problems.push(`command ${name} must start with an absolute or ~/ executable`);
+    else if (!LOCAL_PATH.test(argv[0])) problems.push(`command ${name} must start with an absolute or ~/ executable`);
   }
   return problems;
 }
@@ -959,3 +1110,174 @@ export function cookieValue(header, name = SESSION_COOKIE) {
   }
   return null;
 }
+
+// --- systemd and Task Scheduler (DEC-0032, service.md "Supervisor") -------------------------
+// The twins of fabric_service.systemd_unit / task_xml and their install and uninstall. `run(argv)`
+// returns spawnSync's {status, stdout, stderr}; the tests pass a recorder instead of the real tools.
+
+const defaultRun = (argv) => spawnSync(argv[0], argv.slice(1), { encoding: 'utf8', windowsHide: true });
+
+function plain(value, what) {
+  // A supervisor file is line- and XML-structured: no control character in anything written into it.
+  if (/[\x00-\x1f\x7f]/.test(value)) throw new ServiceError(`${what} holds a control character (a line break, a tab, a NUL); a supervisor file cannot carry it.`);
+  return value;
+}
+
+function noSecretInSupervisorFile(argv, environment) {
+  // No supervisor file carries a secret (service.md): not in an argument, an environment name or its value.
+  for (const arg of argv) {
+    if (secretArgument(arg)) throw new ServiceError('An argument carries a credential; a supervisor file never does (read it from the token file or a secret reference).');
+  }
+  for (const [name, value] of Object.entries(environment ?? {})) {
+    if (credentialName(name) || secretValue(String(value))) throw new ServiceError(`Environment ${name} looks like a credential; a supervisor file never carries one.`);
+  }
+}
+
+function check(result, what) {
+  if (result?.status !== 0) throw new ServiceError(`${what} failed: ${String(result?.stderr || result?.stdout || result?.error?.message || '').trim().slice(0, 200)}`);
+}
+
+const systemdQuote = (value) => `"${plain(value, 'An argument').replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/%/g, '%%').replace(/\$/g, '$$$$')}"`;
+
+/**
+ * A systemd user unit (DEC-0032): Restart=always, RestartSec=10, TimeoutStopSec above the drain time,
+ * WantedBy=default.target. The service is told who supervises it (FABRIC_SERVICE_SUPERVISOR=systemd).
+ */
+export function systemdUnit(unit, programArguments, { workingDirectory, environment = {}, description, stopTimeout = DEFAULT_EXIT_TIMEOUT } = {}) {
+  if (!UNIT.test(unit)) throw new ServiceError(`unit must match ${UNIT.source}`);
+  const argv = programArguments.map(String);
+  if (!argv.length || !argv[0].startsWith('/')) throw new ServiceError('A systemd unit starts an absolute executable.');
+  if (!(stopTimeout > DRAIN_SECONDS)) throw new ServiceError(`TimeoutStopSec must outlast the ${DRAIN_SECONDS} s drain.`);
+  const env = { ...environment };
+  for (const name of Object.keys(env)) if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new ServiceError(`Environment name ${JSON.stringify(name)} is not a variable name.`);
+  noSecretInSupervisorFile(argv, env);
+  env[SUPERVISOR_ENV] ??= 'systemd';
+  const cwd = plain(String(workingDirectory), 'The working directory');
+  if (!cwd.startsWith('/')) throw new ServiceError("A systemd unit's working directory is absolute.");
+  return [
+    '[Unit]', `Description=${plain(description ?? unit, 'The description').replace(/%/g, '%%')}`, '',
+    '[Service]', 'Type=simple', `ExecStart=${argv.map(systemdQuote).join(' ')}`,
+    // Not quoted: systemd reads WorkingDirectory= as the rest of the line, quotes included.
+    `WorkingDirectory=${cwd.replace(/%/g, '%%')}`,
+    ...Object.keys(env).sort().map((k) => `Environment=${systemdQuote(`${k}=${env[k]}`)}`),
+    'Restart=always', 'RestartSec=10', `TimeoutStopSec=${Math.trunc(stopTimeout)}`, 'KillMode=mixed', '',
+    '[Install]', 'WantedBy=default.target', '',
+  ].join('\n');
+}
+
+const systemdDir = () => path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'), 'systemd', 'user');
+
+/**
+ * Write the user unit, enable it so it comes back after a login, and (re)start it so the new unit is what runs.
+ * The operator's intent wins (LC-14): a unit already installed and disabled stays off — the file is rewritten, so the
+ * new version is what starts once they enable it — unless `forceEnable` (the operator asked for it on).
+ */
+export function systemdInstall(unit, text, { unitDir = systemdDir(), run = defaultRun, platform = process.platform, forceEnable = false } = {}) {
+  if (platform !== 'linux') throw new ServiceError('systemd is the supervisor on Linux only.');
+  if (!UNIT.test(unit)) throw new ServiceError(`unit must match ${UNIT.source}`);
+  fs.mkdirSync(unitDir, { recursive: true });
+  const file = path.join(unitDir, unit);
+  const state = fs.existsSync(file) ? String(run(['systemctl', '--user', 'is-enabled', unit])?.stdout ?? '').trim() : '';
+  atomicWrite(file, text, 0o644);
+  check(run(['systemctl', '--user', 'daemon-reload']), 'systemctl --user daemon-reload');
+  if (state === 'disabled' && !forceEnable) return file;
+  check(run(['systemctl', '--user', 'enable', unit]), 'systemctl --user enable');
+  check(run(['systemctl', '--user', 'restart', unit]), 'systemctl --user restart');
+  return file;
+}
+
+/** Stop it and keep it off across logins (`disable --now`), then remove the unit. */
+export function systemdUninstall(unit, { unitDir = systemdDir(), run = defaultRun, platform = process.platform } = {}) {
+  if (platform !== 'linux') throw new ServiceError('systemd is the supervisor on Linux only.');
+  if (!UNIT.test(unit)) throw new ServiceError(`unit must match ${UNIT.source}`);
+  run(['systemctl', '--user', 'disable', '--now', unit]);
+  fs.rmSync(path.join(unitDir, unit), { force: true });
+  check(run(['systemctl', '--user', 'daemon-reload']), 'systemctl --user daemon-reload');
+}
+
+/** One command line from arguments, quoted the way the Microsoft C runtime parses it (Python's list2cmdline). */
+export function windowsCommandLine(args) {
+  return args.map((arg) => {
+    const quote = arg === '' || /[ \t]/.test(arg);
+    let out = quote ? '"' : '';
+    let slashes = 0;
+    for (const c of arg) {
+      if (c === '\\') { slashes += 1; continue; }
+      if (c === '"') { out += '\\'.repeat(slashes * 2 + 1) + '"'; slashes = 0; continue; }
+      out += '\\'.repeat(slashes) + c;
+      slashes = 0;
+    }
+    return out + '\\'.repeat(quote ? slashes * 2 : slashes) + (quote ? '"' : '');
+  }).join(' ');
+}
+
+const xml = (text) => String(text).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+
+/**
+ * A per-user Scheduled Task (DEC-0032): a logon trigger, restart on failure every minute, no execution
+ * time limit, run only when the user is logged on, created without administrator rights.
+ */
+export function taskXml(task, programArguments, { workingDirectory, description, user } = {}) {
+  if (!TASK.test(task)) throw new ServiceError(`task must match ${TASK.source}`);
+  const argv = programArguments.map(String);
+  if (!argv.length || !/^[A-Za-z]:[\\/]/.test(argv[0])) throw new ServiceError('A task starts a drive-absolute executable (C:\\...).');
+  for (const arg of argv) plain(arg, 'An argument');
+  plain(String(workingDirectory), 'The working directory');
+  plain(description ?? task, 'The description');
+  noSecretInSupervisorFile(argv, {});
+  const who = user ?? (process.env.USERNAME ? `${process.env.USERDOMAIN ?? ''}\\${process.env.USERNAME}` : '');
+  if (!who) throw new ServiceError('Name the user the task runs as (DOMAIN\\user); USERNAME is not set.');
+  plain(who, 'The user');
+  return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo><Description>${xml(description ?? task)}</Description><URI>${xml(task)}</URI></RegistrationInfo>
+  <Triggers><LogonTrigger><Enabled>true</Enabled><UserId>${xml(who)}</UserId></LogonTrigger></Triggers>
+  <Principals><Principal id="Author"><UserId>${xml(who)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <Enabled>true</Enabled>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <RestartOnFailure><Interval>PT1M</Interval><Count>999</Count></RestartOnFailure>
+  </Settings>
+  <Actions Context="Author"><Exec><Command>${xml(argv[0])}</Command><Arguments>${xml(windowsCommandLine(argv.slice(1)))}</Arguments><WorkingDirectory>${xml(workingDirectory)}</WorkingDirectory></Exec></Actions>
+</Task>
+`;
+}
+
+const TASK_DISABLED = /<Settings>(?:(?!<\/Settings>)[\s\S])*<Enabled>false<\/Enabled>/;
+
+/**
+ * Create (or replace) the task from its XML without administrator rights, then (re)start it so the new definition
+ * is what runs. A task already installed and disabled stays off (LC-14) unless `forceEnable`.
+ */
+export function taskInstall(task, xmlText, { run = defaultRun, platform = process.platform, forceEnable = false } = {}) {
+  if (platform !== 'win32') throw new ServiceError('Task Scheduler is the supervisor on Windows only.');
+  const query = run(['schtasks', '/Query', '/TN', task, '/XML']);
+  const existed = query?.status === 0;
+  const keepOff = existed && !forceEnable && TASK_DISABLED.test(String(query?.stdout ?? ''));
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'fabric-task-'));
+  const file = path.join(dir, 'task.xml');
+  try {
+    // schtasks reads the encoding the declaration names: UTF-16 little-endian with its byte order mark.
+    fs.writeFileSync(file, Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from(xmlText, 'utf16le')]));
+    check(run(['schtasks', '/Create', '/TN', task, '/XML', file, '/F']), 'schtasks /Create');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+  if (keepOff) {
+    check(run(['schtasks', '/Change', '/TN', task, '/DISABLE']), 'schtasks /Change /DISABLE');
+    return;
+  }
+  if (existed) run(['schtasks', '/End', '/TN', task]);
+  check(run(['schtasks', '/Run', '/TN', task]), 'schtasks /Run');
+}
+
+/** End the running task, then delete it. */
+export function taskUninstall(task, { run = defaultRun, platform = process.platform } = {}) {
+  if (platform !== 'win32') throw new ServiceError('Task Scheduler is the supervisor on Windows only.');
+  run(['schtasks', '/End', '/TN', task]);
+  check(run(['schtasks', '/Delete', '/TN', task, '/F']), 'schtasks /Delete');
+}

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_service.py

@@ -18,13 +18,16 @@ import hashlib
 import hmac
 import http.server
 import json
+import ntpath
 import os
-from pathlib import Path
+from pathlib import Path, PurePath
 import plistlib
+import posixpath
 import re
 import secrets
 import shutil
 import signal
+import socket
 import socketserver
 import stat
 import subprocess
@@ -185,15 +188,15 @@ def atomic_write(path: Path, data: bytes, mode: int = 0o600) -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
     fd, tmp = tempfile.mkstemp(prefix="." + path.name + ".", dir=str(path.parent))
     try:
+        if WINDOWS:
+            # The file's ACL is its privacy (DEC-0032): set explicitly and protected — before the bytes go in — so
+            # it does not depend on what the folder hands down. A rename keeps it.
+            _win_protect(Path(tmp), folder=False)
         with os.fdopen(fd, "wb") as handle:
             handle.write(data)
             handle.flush()
             os.fsync(handle.fileno())
-        if WINDOWS:
-            # The file's ACL is its privacy (DEC-0032): set explicitly and protected, so it does
-            # not depend on what the folder hands down. A rename keeps it.
-            _win_protect(Path(tmp), folder=False)
-        else:
+        if not WINDOWS:
             os.chmod(tmp, mode)
         os.replace(tmp, path)
     except BaseException:
@@ -217,6 +220,7 @@ class InstanceLock:
     def __init__(self, data_dir: Path):
         self.path = Path(data_dir) / "service.lock"
         self._fd: Optional[int] = None
+        self._name: Any = None
 
     #: Windows locks a byte range, not the file: one byte far past the pid the file holds, so the
     #: holder may rewrite the pid and another process may still read it (locking past the end of
@@ -242,6 +246,11 @@ class InstanceLock:
             if exc.errno in (errno.EWOULDBLOCK, errno.EAGAIN, errno.EACCES, getattr(errno, "EDEADLOCK", -1)):
                 raise AlreadyRunning(_read_pid(self.path), self.path) from None
             raise
+        try:
+            self._name = _hold_lock_name(self.path)
+        except BaseException:
+            os.close(fd)
+            raise
         os.ftruncate(fd, 0)
         os.write(fd, str(os.getpid()).encode())
         os.fsync(fd)
@@ -252,6 +261,70 @@ class InstanceLock:
         if self._fd is not None:
             os.close(self._fd)
             self._fd = None
+        if self._name is not None:
+            _drop_lock_name(self._name)
+            self._name = None
+
+
+# The Node kit cannot flock on Linux or lock a byte range on Windows, so it holds a name instead: an
+# abstract unix socket on Linux, a named pipe on Windows — exclusive, no file, gone with the process.
+# This kit holds the same name beside its file lock, so the two kits exclude each other everywhere
+# and the probe sees either one (`lock_name_held`).
+
+def lock_name(lock_path: Path, platform: str = sys.platform) -> Optional[str]:
+    """The name the Node kit holds for this lock file; None where it holds none (macOS: O_EXLOCK)."""
+    if platform.startswith("linux"):
+        digest = hashlib.sha256(posixpath.abspath(str(lock_path)).encode()).hexdigest()[:32]
+        return "\0fabric-service-" + digest
+    if platform == "win32":
+        # Windows paths compare without case: C:\Users and c:\users are one lock.
+        digest = hashlib.sha256(ntpath.normcase(ntpath.abspath(str(lock_path))).encode()).hexdigest()[:32]
+        return "\\\\.\\pipe\\fabric-service-" + digest
+    return None
+
+
+def _hold_lock_name(lock_path: Path) -> Any:
+    name = lock_name(lock_path)
+    if name is None:
+        return None
+    if WINDOWS:
+        handle = _create_first_pipe(name)
+        if handle is None:
+            raise AlreadyRunning(_read_pid(lock_path), lock_path)
+        return handle
+    sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    try:
+        sock.bind(name)
+    except OSError as exc:
+        sock.close()
+        if exc.errno == errno.EADDRINUSE:
+            raise AlreadyRunning(_read_pid(lock_path), lock_path) from None
+        raise
+    # Held by its descriptor, like the file lock: a socket object would close when collected.
+    return sock.detach()
+
+
+def _drop_lock_name(held: Any) -> None:
+    if WINDOWS:
+        _close_handle(held)
+    else:
+        os.close(held)
+
+
+def lock_name_held(lock_path: Path) -> Optional[bool]:
+    """True when some process holds the lock's name (a running service of either kit); None where there is no name
+    to hold. It only looks — /proc/net/unix on Linux, WaitNamedPipeW on Windows — and never takes the name, so a
+    probe cannot make a service that is starting at that moment fail."""
+    name = lock_name(lock_path)
+    if name is None:
+        return None
+    if WINDOWS:
+        return _pipe_exists(name)
+    try:
+        with open("/proc/net/unix", encoding="utf-8", errors="replace") as table:
+            return any(line.rstrip("\n").endswith(" @" + name[1:]) for line in table)
+    except OSError:
+        return None
 
 
 def _read_pid(path: Path) -> Optional[int]:
@@ -262,6 +335,15 @@ def _read_pid(path: Path) -> Optional[int]:
         return None
 
 
+SUPERVISORS = ("launchd", "systemd", "task-scheduler")
+
+
+def supervised() -> bool:
+    """True when a supervisor that restarts on exit started this process and said so in
+    ``FABRIC_SERVICE_SUPERVISOR`` (``launchd_plist`` and ``systemd_unit`` set it)."""
+    return os.environ.get(SUPERVISOR_ENV) in SUPERVISORS
+
+
 def supervised_by_launchd() -> bool:
     """True when launchd started this process from a plist written by ``launchd_plist``.
 
@@ -281,7 +363,7 @@ def hold_single_instance(data_dir: Path, wait_seconds: Optional[float] = None, *
     leaves, and exits 75 only when the wait runs out. Nothing has been touched while it waits.
     ``wait_seconds`` overrides the choice (0 = never wait)."""
     if wait_seconds is None:
-        wait_seconds = LOCK_WAIT_SUPERVISED_SECONDS if supervised_by_launchd() else 0.0
+        wait_seconds = LOCK_WAIT_SUPERVISED_SECONDS if supervised() else 0.0
     deadline = clock() + max(0.0, wait_seconds)
     delay = LOCK_BACKOFF_FIRST_SECONDS
     announced = False
@@ -440,6 +522,35 @@ if WINDOWS:  # pragma: no cover - exercised by the Windows CI job
         finally:
             _kernel32.LocalFree(sd)
 
+    _kernel32.CreateNamedPipeW.argtypes = [wintypes.LPCWSTR] + [wintypes.DWORD] * 6 + [_PVOID]
+    _kernel32.CreateNamedPipeW.restype = wintypes.HANDLE
+    _INVALID_HANDLE = wintypes.HANDLE(-1).value
+
+    def _create_first_pipe(name: str) -> Any:
+        """The pipe's first instance, or None when another process holds it (ERROR_ACCESS_DENIED)."""
+        # PIPE_ACCESS_INBOUND | FILE_FLAG_FIRST_PIPE_INSTANCE; PIPE_REJECT_REMOTE_CLIENTS; unlimited instances,
+        # as libuv creates them: then a second first-instance attempt, ours or the Node kit's, is refused with
+        # ERROR_ACCESS_DENIED (Node: EADDRINUSE), never ERROR_PIPE_BUSY.
+        handle = _kernel32.CreateNamedPipeW(name, 0x1 | 0x00080000, 0x8, 255, 0, 0, 0, None)
+        if handle == _INVALID_HANDLE:
+            code = ctypes.get_last_error()
+            if code in (5, 231):  # ERROR_ACCESS_DENIED, ERROR_PIPE_BUSY: another process holds it
+                return None
+            raise _win_error("CreateNamedPipeW", code)
+        return handle
+
+    def _close_handle(handle: Any) -> None:
+        _kernel32.CloseHandle(handle)
+
+    _kernel32.WaitNamedPipeW.argtypes = [wintypes.LPCWSTR, wintypes.DWORD]
+    _kernel32.WaitNamedPipeW.restype = wintypes.BOOL
+
+    def _pipe_exists(name: str) -> bool:
+        """Some process holds the pipe: waiting for it does not fail with ERROR_FILE_NOT_FOUND. Nothing connects."""
+        if _kernel32.WaitNamedPipeW(name, 1):
+            return True
+        return ctypes.get_last_error() != 2
+
     def _win_token_problem(path: Path, info: os.stat_result) -> Optional[str]:
         if getattr(info, "st_file_attributes", 0) & _REPARSE_POINT or not stat.S_ISREG(info.st_mode):
             return "Token file %s is not a regular file (a link or junction); refusing it." % path
@@ -450,6 +561,15 @@ if WINDOWS:  # pragma: no cover - exercised by the Windows CI job
         owner, granting = windows_acl(path)
         return token_acl_problem(path, owner, granting, windows_user_sid())
 else:
+    def _create_first_pipe(name: str) -> Any:  # noqa: ARG001
+        raise ServiceError("named pipes exist only on Windows")
+
+    def _close_handle(handle: Any) -> None:  # noqa: ARG001
+        raise ServiceError("handles exist only on Windows")
+
+    def _pipe_exists(name: str) -> bool:  # noqa: ARG001
+        raise ServiceError("named pipes exist only on Windows")
+
     def _win_protect(path: Path, folder: bool) -> None:  # noqa: ARG001 - POSIX uses modes
         raise ServiceError("Windows ACLs exist only on Windows")
 
@@ -1516,6 +1636,187 @@ def cookie_value(cookie_header: Optional[str], name: str = SESSION_COOKIE) -> Op
 
 # --- launchd -----------------------------------------------------------------
 
+# --- systemd and Task Scheduler (DEC-0032, service.md "Supervisor") ------------------
+
+def _no_secret_in_supervisor_file(argv: Sequence[str], environment: Optional[Dict[str, str]]) -> None:
+    """No supervisor file carries a secret (service.md): not in an argument, an environment name or its value."""
+    import fabric_secrets  # noqa: E402 - beside this file; the contract's detector (DEC-0044)
+    for arg in argv:
+        if fabric_secrets.secret_argument(arg):
+            raise ServiceError("an argument carries a credential; a supervisor file never does (read it from the token file or a secret reference)")
+    for name, value in (environment or {}).items():
+        if fabric_secrets.credential_name(name) or fabric_secrets.secret_value(str(value)):
+            raise ServiceError("environment %s looks like a credential; a supervisor file never carries one" % name)
+
+
+def _plain(value: str, what: str) -> str:
+    """A supervisor file is line- and XML-structured: no control character in anything written into it."""
+    if re.search(r"[\x00-\x1f\x7f]", value):
+        raise ServiceError("%s holds a control character (a line break, a tab, a NUL); a supervisor file cannot carry it" % what)
+    return value
+
+
+def _systemd_quote(value: str) -> str:
+    _plain(value, "an argument")
+    escaped = value.replace("\\", "\\\\").replace('"', '\\"').replace("%", "%%").replace("$", "$$")
+    return '"%s"' % escaped
+
+
+def systemd_unit(unit: str, program_arguments: Sequence[str], *, working_directory: Path,
+                 environment: Optional[Dict[str, str]] = None, description: Optional[str] = None,
+                 stop_timeout: int = DEFAULT_EXIT_TIMEOUT) -> str:
+    """A systemd user unit (DEC-0032): Restart=always, RestartSec=10, TimeoutStopSec above the drain time,
+    WantedBy=default.target. The service is told who supervises it (FABRIC_SERVICE_SUPERVISOR=systemd)."""
+    if not _UNIT.match(unit):
+        raise ServiceError("unit must match %s" % _UNIT.pattern)
+    argv = [str(a) for a in program_arguments]
+    if not argv or not argv[0].startswith("/"):
+        raise ServiceError("a systemd unit starts an absolute executable")
+    if stop_timeout <= DRAIN_SECONDS:
+        raise ServiceError("TimeoutStopSec must outlast the %d s drain" % DRAIN_SECONDS)
+    env = dict(environment or {})
+    _no_secret_in_supervisor_file(argv, env)
+    env.setdefault(SUPERVISOR_ENV, "systemd")
+    # A unit is a Linux file: a Path built anywhere (a test on Windows, an installer's planner) names a POSIX path.
+    cwd = _plain(working_directory.as_posix() if isinstance(working_directory, PurePath) else str(working_directory),
+                 "the working directory")
+    if not cwd.startswith("/"):
+        raise ServiceError("a systemd unit's working directory is absolute")
+    lines = ["[Unit]", "Description=%s" % _plain(description or unit, "the description").replace("%", "%%"), "",
+             "[Service]", "Type=simple", "ExecStart=%s" % " ".join(_systemd_quote(a) for a in argv),
+             # Not quoted: systemd reads WorkingDirectory= as the rest of the line, quotes included.
+             "WorkingDirectory=%s" % cwd.replace("%", "%%")]
+    for name in env:
+        if not re.match(r"^[A-Za-z_][A-Za-z0-9_]*$", name):
+            raise ServiceError("environment name %r is not a variable name" % name)
+    lines += ["Environment=%s" % _systemd_quote("%s=%s" % (k, v)) for k, v in sorted(env.items())]
+    lines += ["Restart=always", "RestartSec=10", "TimeoutStopSec=%d" % stop_timeout, "KillMode=mixed", "",
+              "[Install]", "WantedBy=default.target", ""]
+    return "\n".join(lines)
+
+
+def _systemd_dir() -> Path:
+    return Path(os.environ.get("XDG_CONFIG_HOME") or Path.home() / ".config") / "systemd" / "user"
+
+
+def _check(result: Any, what: str) -> None:
+    if getattr(result, "returncode", 1) != 0:
+        raise ServiceError("%s failed: %s" % (what, (getattr(result, "stderr", "") or getattr(result, "stdout", "") or "").strip()[:200]))
+
+
+def systemd_install(unit: str, text: str, *, unit_dir: Optional[Path] = None, run: Callable[..., Any] = subprocess.run,
+                    system: str = sys.platform, force_enable: bool = False) -> Path:
+    """Write the user unit, enable it so it comes back after a login, and (re)start it so the new unit is what runs.
+
+    The operator's intent wins (LC-14): a unit already installed and disabled stays off — the file is rewritten, so
+    the new version is what starts once they enable it — unless ``force_enable`` (the operator asked for it on)."""
+    if not system.startswith("linux"):
+        raise ServiceError("systemd is the supervisor on Linux only")
+    if not _UNIT.match(unit):
+        raise ServiceError("unit must match %s" % _UNIT.pattern)
+    folder = unit_dir or _systemd_dir()
+    folder.mkdir(parents=True, exist_ok=True)
+    path = folder / unit
+    first = not path.exists()
+    state = "" if first else (getattr(run(["systemctl", "--user", "is-enabled", unit], capture_output=True, text=True),
+                                      "stdout", "") or "").strip()
+    atomic_write(path, text.encode("utf-8"), 0o644)
+    _check(run(["systemctl", "--user", "daemon-reload"], capture_output=True, text=True), "systemctl --user daemon-reload")
+    if state == "disabled" and not force_enable:
+        return path
+    _check(run(["systemctl", "--user", "enable", unit], capture_output=True, text=True), "systemctl --user enable")
+    _check(run(["systemctl", "--user", "restart", unit], capture_output=True, text=True), "systemctl --user restart")
+    return path
+
+
+def systemd_uninstall(unit: str, *, unit_dir: Optional[Path] = None, run: Callable[..., Any] = subprocess.run,
+                      system: str = sys.platform) -> None:
+    """Stop it and keep it off across logins (`disable --now`), then remove the unit."""
+    if not system.startswith("linux"):
+        raise ServiceError("systemd is the supervisor on Linux only")
+    run(["systemctl", "--user", "disable", "--now", unit], capture_output=True, text=True)
+    path = (unit_dir or _systemd_dir()) / unit
+    if path.exists():
+        path.unlink()
+    _check(run(["systemctl", "--user", "daemon-reload"], capture_output=True, text=True), "systemctl --user daemon-reload")
+
+
+def _xml(text: str) -> str:
+    return (text.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;").replace('"', "&quot;"))
+
+
+def task_xml(task: str, program_arguments: Sequence[str], *, working_directory: str, description: Optional[str] = None,
+             user: Optional[str] = None) -> str:
+    """A per-user Scheduled Task (DEC-0032): a logon trigger, restart on failure every minute, no execution time limit,
+    run only when the user is logged on, created without administrator rights."""
+    if not _TASK.match(task):
+        raise ServiceError("task must match %s" % _TASK.pattern)
+    argv = [str(a) for a in program_arguments]
+    if not argv or not re.match(r"^[A-Za-z]:[\\/]", argv[0]):
+        raise ServiceError("a task starts a drive-absolute executable (C:\\…)")
+    for value, what in [(a, "an argument") for a in argv] + [(str(working_directory), "the working directory"),
+                                                           (description or task, "the description")]:
+        _plain(value, what)
+    _no_secret_in_supervisor_file(argv, None)
+    who = user or ("%s\\%s" % (os.environ.get("USERDOMAIN", ""), os.environ["USERNAME"]) if os.environ.get("USERNAME") else "")
+    if not who:
+        raise ServiceError("name the user the task runs as (DOMAIN\\user); USERNAME is not set")
+    _plain(who, "the user")
+    body = """<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo><Description>{desc}</Description><URI>{task}</URI></RegistrationInfo>
+  <Triggers><LogonTrigger><Enabled>true</Enabled><UserId>{user}</UserId></LogonTrigger></Triggers>
+  <Principals><Principal id="Author"><UserId>{user}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <Enabled>true</Enabled>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <RestartOnFailure><Interval>PT1M</Interval><Count>999</Count></RestartOnFailure>
+  </Settings>
+  <Actions Context="Author"><Exec><Command>{command}</Command><Arguments>{arguments}</Arguments><WorkingDirectory>{cwd}</WorkingDirectory></Exec></Actions>
+</Task>
+""".format(desc=_xml(description or task), task=_xml(task), user=_xml(who), command=_xml(argv[0]),
+           arguments=_xml(subprocess.list2cmdline(argv[1:])), cwd=_xml(str(working_directory)))
+    return '<?xml version="1.0" encoding="UTF-16"?>\n' + body
+
+
+_TASK_DISABLED = re.compile(r"<Settings>(?:(?!</Settings>).)*<Enabled>false</Enabled>", re.S)
+
+
+def task_install(task: str, xml_text: str, *, run: Callable[..., Any] = subprocess.run, system: str = sys.platform,
+                 force_enable: bool = False) -> None:
+    """Create (or replace) the task from its XML without administrator rights, then (re)start it so the new
+    definition is what runs. A task already installed and disabled stays off (LC-14) unless ``force_enable``."""
+    if system != "win32":
+        raise ServiceError("Task Scheduler is the supervisor on Windows only")
+    query = run(["schtasks", "/Query", "/TN", task, "/XML"], capture_output=True, text=True)
+    existed = getattr(query, "returncode", 1) == 0
+    keep_off = existed and not force_enable and bool(_TASK_DISABLED.search(getattr(query, "stdout", "") or ""))
+    fd, name = tempfile.mkstemp(suffix=".xml")
+    try:
+        with os.fdopen(fd, "wb") as handle:
+            handle.write(xml_text.encode("utf-16"))
+        _check(run(["schtasks", "/Create", "/TN", task, "/XML", name, "/F"], capture_output=True, text=True), "schtasks /Create")
+    finally:
+        os.unlink(name)
+    if keep_off:
+        _check(run(["schtasks", "/Change", "/TN", task, "/DISABLE"], capture_output=True, text=True), "schtasks /Change /DISABLE")
+        return
+    if existed:
+        run(["schtasks", "/End", "/TN", task], capture_output=True, text=True)
+    _check(run(["schtasks", "/Run", "/TN", task], capture_output=True, text=True), "schtasks /Run")
+
+
+def task_uninstall(task: str, *, run: Callable[..., Any] = subprocess.run, system: str = sys.platform) -> None:
+    """End the running task, then delete it."""
+    if system != "win32":
+        raise ServiceError("Task Scheduler is the supervisor on Windows only")
+    run(["schtasks", "/End", "/TN", task], capture_output=True, text=True)
+    _check(run(["schtasks", "/Delete", "/TN", task, "/F"], capture_output=True, text=True), "schtasks /Delete")
+
+
 def launchd_plist(label: str, program_arguments: Sequence[str], *, working_directory: Path,
                   stdout_path: Path, environment: Optional[Dict[str, str]] = None,
                   exit_timeout: int = DEFAULT_EXIT_TIMEOUT) -> bytes:

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.17.0"
+  version: "0.18.0"
   contract-version: "0.1.0"
   contract-commit: "0cacd08b0e95b6abf131eae1206b60792138bc3c"
 ---